Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters. tactic: TA0011 ✕

Download CSV Show ATT&CK heatmap
  • A non-browser process accessed a website UI Informational 3 variations

    An uncommon network communication between a non-browser process and a website UI.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Day
    ATT&CK tactics: Command and Control (TA0011)
    ATT&CK techniques: Web Service (T1102)
    Required data: Palo Alto Networks Url Logs
    Attacker's goals: Data exfiltration or attack tool staging.
    Investigative actions: Examine the host to verify that the host was not part of infiltration or data exfiltration from the organization. Verify that the host doesn't have sensitive company data that can be easily exfiltrated.

    Variations

    Suspicious content upload to a known text share website by Non browser process

    High overridden

    Uncommon data upload to a known text share website through a Non-browser process. overridden

    Uncommon data upload to a website through a Non-browser process

    Low overridden

    Uncommon data upload to a website through a Non browser process. overridden

    Uncommon data download from a known text share website through a Non-browser process

    Medium overridden

    Uncommon content download from a known text share website through a Non browser process. overridden